Never Let Your SSL Certificate Expire Again

The Cost of an Expired SSL Certificate

When your SSL certificate expires:

• Visitors see a scary browser warning
• Google may de-index your pages
• APIs relying on your domain will fail
• Your brand credibility takes a hit
• Revenue loss from blocked transactions

Even major companies like LinkedIn, Microsoft, and Spotify have had SSL certificate expiration incidents.

How SSL Monitoring Works

ServerGuard's HTTP Monitor checks your SSL certificates automatically:

1. Probes your endpoints on a schedule (every 5 minutes)
2. Checks certificate expiry date
3. Validates the certificate chain for trust issues
4. Alerts you at 30, 14, 7, and 1 day before expiration

Setting Up SSL Monitoring

With ServerGuard

Add your domains in the HTTP Monitor section:

1. Go to HTTP Monitor in your dashboard
2. Click Add Endpoint
3. Enter your HTTPS URL
4. Set check interval (recommended: 5 minutes)
5. Enable SSL certificate monitoring

With Let's Encrypt Auto-Renewal

# Install certbot
sudo apt install certbot python3-certbot-nginx

# Get a certificate
sudo certbot --nginx -d yourdomain.com

# Verify auto-renewal
sudo certbot renew --dry-run

# Check renewal timer
systemctl status certbot.timer

Manual Check

# Check certificate expiry
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates

# Check days until expiry
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -enddate

Best Practices

1. Automate renewal — Use Let's Encrypt with certbot for free, auto-renewing certificates
2. Monitor anyway — Even with auto-renewal, things can fail. Always monitor
3. Alert early — 30 days before expiry gives you plenty of time
4. Test the renewal — Run certbot renew --dry-run monthly
5. Monitor all domains — Don't forget subdomains, API endpoints, and staging servers

Common Pitfalls

• DNS changes blocking Let's Encrypt verification
• Firewall rules blocking port 80 for HTTP-01 challenges
• Certbot not running due to disabled timer/cron
• Certificate chain issues after renewal
• Hardcoded certificate paths in application config

Conclusion

SSL certificate monitoring is simple to set up and prevents embarrassing, costly outages. Add it to your monitoring stack today and never worry about expired certificates again.